GIAC GSEC
GIAC Security Essentials (GSEC) is the hands-on technical breadth cert in the GIAC catalog, spanning 25 topic areas per GIAC's own outline, grouped here into 6 broader domains. 106 questions, 4 hours, open-book proctored, 72% passing score for exam versions released on or after April 6, 2026.
We could not confirm which languages this exam is offered in. Check the owner's page before you book.
Owner: GIAC · Read: · Source: GIAC GSEC certification page
Exam fee at last check: $999, per the vendor. The official objectives are at www.giac.org/certifications/security-essentials-gsec/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Defense in Depth, Access Control, and Password Management
Layered security architecture, access control models, and current password guidance.
- Defense in depth: independent layered controls
- NIST SP 800-63B: length over forced rotation, breach-corpus checking
- RBAC vs DAC vs MAC access control models
- Least privilege scoping to limit compromised-account blast radius
Primary sources: NIST SP 800-53 Rev. 5, NIST SP 800-63B, Digital Identity Guidelines
Networking, Protocols, and Wireless Security
TCP/IP fundamentals, network segmentation, wireless security, and DNS-based attack techniques.
- TCP three-way handshake
- VLANs and inter-VLAN access control for logical segmentation
- WPA3's SAE vs WPA2-PSK's 4-way handshake
- DNS tunneling as an exfiltration/C2 technique
Primary sources: RFC 793, Transmission Control Protocol, MITRE ATT&CK T1071.004
Cryptography
Key exchange, hashing for integrity, and the PKI trust model behind TLS.
- Diffie-Hellman key exchange
- Cryptographic hashing for integrity verification, independent of confidentiality
- Certificate Authorities and the browser/OS trust store chain of trust
Primary sources: NIST SP 800-56A Rev. 3, NIST FIPS 180-4, Secure Hash Standard
Incident Handling, Log Management, and SIEM
NIST incident-handling lifecycle, SIEM correlation, and evidence-collection sequencing.
- Containment, Eradication, and Recovery phase actions
- SIEM as cross-source log correlation and alerting
- Order of volatility for live evidence collection
Primary sources: NIST SP 800-61 Rev. 2, NIST SP 800-92, Guide to Computer Security Log Management
Windows and Linux Security, Hardening, and Forensics
OS-level privilege scoping, authentication logging, and attack-surface reduction.
- sudo/sudoers for scoped privilege elevation on Linux
- Windows Security Event Log logon/logoff event IDs (4624/4625)
- Least functionality / minimal installation hardening
Primary sources: sudoers manual, Microsoft Learn, Audit logon events
Web, Cloud, Virtualization, and AI Essentials
Web application vulnerability classes plus the newer cloud, virtualization, and AI-security content GIAC added to the outline.
- SQL injection
- VM escape / hypervisor breakout risk in shared virtualization
- Prompt injection as the AI-specific analogue of instruction-override attacks
- The shared responsibility model and its common misapplication
Primary sources: OWASP Top 10:2021, OWASP Top 10 for LLM Applications 2025, NIST SP 800-145, The NIST Definition of Cloud Computing
Exam-day strategy
GSEC is open-book: build an indexed reference binder organized by topic before the exam, since flipping through an unindexed printout wastes exam time.
The exam assumes hands-on familiarity, not just terminology recognition; expect scenarios that describe actual command output or packet captures.
Watch for AI/cloud/virtualization distractors that name a plausible-sounding but wrong concept (e.g., VM escape vs prompt injection vs SQL injection) for a similar-sounding scenario.
Pace at roughly 2 minutes 15 seconds per question across the 4-hour, 106-question exam.
How to prepare for GIAC GSEC
- EVIDENCE-BACKEDPractice in the same format as the exam. How well practice matches the final test shapes how much it helps. (Yang et al., 2021)
- EVIDENCE-BACKEDStart practice questions in week one, even on topics you have not studied. Failed attempts before seeing the answer still helped learning. (Kornell et al., 2009 and others)
- EVIDENCE-BACKEDSpace your reviews over weeks instead of cramming the week before. (Cepeda et al., 2006 and others)
- PLAUSIBLEDivide the minutes by the questions before you start, and keep a margin for a second pass if the exam allows one. (Sound arithmetic; no study compared time budgets on a licensing exam.)
Why this works
EVIDENCE-BACKED At least one peer-reviewed study or official source found the effect or states the fact. A study can be small.
PLAUSIBLE Reasonable and partly studied, but not tested on exams, or the results are mixed.
Practice that matches the final test format works better than practice that does not.
Failed attempts before seeing the answer still improved later learning of the material asked about; the benefit for material not asked about was virtually nil.
Spacing beat massing across hundreds of experiments and beat cramming with flashcards; combined with retrieval it raised scores on a real high-stakes exam.
Sound arithmetic; no study compared time budgets on a licensing exam.
Sources
- Yang, C., Luo, L., Vadillo, M. A., Yu, R., & Shanks, D. R. (2021). Testing (quizzing) boosts classroom learning: A systematic and meta-analytic review. Psychological Bulletin, 147(4), 399-435. doi.org/10.1037/bul0000309
- Kornell, N., Hays, M. J., & Bjork, R. A. (2009). Unsuccessful retrieval attempts enhance subsequent learning. Journal of Experimental Psychology: Learning, Memory, and Cognition, 35(4), 989-998. doi.org/10.1037/a0015729
- Richland, L. E., Kornell, N., & Kao, L. S. (2009). The pretesting effect: Do unsuccessful retrieval attempts enhance learning? Journal of Experimental Psychology: Applied, 15(3), 243-257. doi.org/10.1037/a0016496
- St. Hilaire, K. J., Chan, J. C. K., & Ahn, D. (2024). Guessing as a learning intervention: A meta-analytic review of the prequestion effect. Psychonomic Bulletin & Review, 31(2), 411-441. doi.org/10.3758/s13423-023-02353-8
- Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3), 354-380. doi.org/10.1037/0033-2909.132.3.354
- Kornell, N. (2009). Optimising learning using flashcards: Spacing is more effective than cramming. Applied Cognitive Psychology, 23(9), 1297-1317. doi.org/10.1002/acp.1537
- Kang, S. H. K. (2016). Spaced repetition promotes efficient and effective learning: Policy implications for instruction. Policy Insights from the Behavioral and Brain Sciences, 3(1), 12-19. doi.org/10.1177/2372732215624708
- Janes, J. L., Dunlosky, J., Rawson, K. A., & Jasnow, A. (2020). Successive relearning improves performance on a high-stakes exam in a difficult biopsychology course. Applied Cognitive Psychology, 34(5), 1118-1132. doi.org/10.1002/acp.3699
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of GIAC. GSEC (GIAC Security Essentials Certification) is a trademark of GIAC. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.